Account security
Your account
Sign in with email and password, a magic link, or a social provider, depending on what's enabled for your deployment. Manage all of it under Account.
- Two-factor authentication — enable TOTP under Account → Security and pair any authenticator app. Recovery codes are shown once; store them somewhere you'll still have if you lose the phone.
- Sessions — Account → Sessions lists where you're signed in, with device and last activity. Revoke any you don't recognise; revoking ends that session immediately.
- Password — changing it signs out other sessions.
How your credentials are stored
| Credential | How it's kept |
|---|---|
| Moodle web-service token | Encrypted at rest (AES-256-GCM). Never shown again after it's stored. |
| MCP key | Only its hash, its last 4 characters and its status. The value is shown once, at creation. |
| Panel secret | Used to verify request signatures; shown once, rotatable. |
| License key | Identifies the install. Useless without a valid signature. |
Because the panel keeps hashes rather than key values, nobody — including support — can retrieve a lost key. Mint a new one and revoke the old.
What protects the connection
- Every plugin↔panel request is signed with HMAC-SHA256 and rejected outside a ±5-minute window, which closes the replay window.
- An unknown license and a bad signature return the same error, so the API can't be used to enumerate installs.
- Your Moodle URL is validated against private address ranges, and calls to it go through an SSRF-pinned client with a timeout and a response-size cap.
- MCP credentials are checked on every request, so revocation takes effect on the next call.
If something is compromised
- A key leaked — revoke it in Organization → Moodle → MCP keys. The next call it makes is refused. Mint a replacement.
- The panel secret leaked — rotate credentials in Organization → Moodle, then paste the new pair into the plugin.
- An account is compromised — change the password (which signs out other sessions), revoke remaining sessions, and enable two-factor.
Owners and admins are notified when credentials are rotated, so an unexpected notification is worth investigating rather than dismissing.
Good habits
- One key per person or integration, so revocation is surgical.
- Read-only by default; grant write access deliberately.
- Set an expiry on anything temporary.
- Review last used in the keys list periodically and revoke what's idle.